From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=103.168.172.146 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794413291; b=OTapRwhOc7wIWMHlXpb8An2NP1SOcyImTuaZ2zbC4XdQ283VMXAXi9vDYjHzsEJgR992 HwIL3UYwIAQuSz0pxRQ6/TGeej8hAgYR57+nbbsb2K9P+KYXVbZqTLSyGx1Z9lGEJX9Fv CxEmw7JYayYKV5+QAaWzscIaymN6Xv0AdOwxsnooAlJTfd+fujHDg7/SlZRCmnYztgzjU CuRTH+TZd1bu8Q6fpcaB53xkhPrsEXBH0G3T/5/Hr6DTcvHyyt/2toLfUE3iwevos9QYh eQepnvYnH1VC5qLjvy4OYSL1ov2KnPbb5UFS9HMnG7mJhuiBGE1iqzQfTHHHxfwLBfA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794413291; h=DMARC-Filter:Received:Received:DKIM-Signature:DKIM-Signature: X-DKIM2-Info:DKIM2-Signature:X-DKIM2-Info:Message-Instance: X-ME-Sender:X-ME-Received:X-ME-Proxy-Cause:X-ME-Proxy:Feedback-ID: Received:From:To:Cc:Subject:Date:Message-ID:X-Mailer:In-Reply-To: References:MIME-Version:Content-Transfer-Encoding; bh=xNI7FhhWXJTVEfgFdiCjAwu1qJ5S7uLHPAT406qre8I=; b=yRTemLlxTCuTIeq/BDenpZNcu/mtqL3o/HaGQ1gFmP8lwifE3PilbRrvcUEF9UmUAK7x tiZoCBHV6FIwgPQiyUxTZ3WDmmhbKPXlsJcVaKvvx3hC+nhw2uWlJe4vpEqhIvYMKvVT1 /6ktWscG+cxQLHVeUhDQnL2J8spnVD+u1k1XJ2iUQj0cS6V0w/6zbEA5fNwNehSWkenN7 /OyDhAuIr0KBtingnJcLpKO1oUH9/aYWcDzW4OrsNNthwHREFkiyF5CNStmNuQuLpuiqN LSit9npTkbo18hDM/DKHXQqTzhgitsdmGpXSJnM0NICkunyOY1+W2C43SKTQm85+6QQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=fastmail.org; spf=pass smtp.mailfrom=fastmail.org; dkim=pass header.d=fastmail.org header.i=@fastmail.org header.a=rsa-sha256 header.s=fm3 header.b=h49wniB0; dkim=pass header.d=messagingengine.com header.i=@messagingengine.com header.a=rsa-sha256 header.s=fm3 header.b=IFU7woW5; arc=none smtp.remote-ip=103.168.172.146 Received: from fout-a3-smtp.messagingengine.com (fout-a3-smtp.messagingengine.com [103.168.172.146]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 095B9606A32D for ; Wed, 11 Nov 2026 16:08:10 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 095B9606A32D Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=fastmail.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=fastmail.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=fastmail.org header.i=@fastmail.org header.a=rsa-sha256 header.s=fm3 header.b=h49wniB0; dkim=pass (2048-bit key, unprotected) header.d=messagingengine.com header.i=@messagingengine.com header.a=rsa-sha256 header.s=fm3 header.b=IFU7woW5 Received: from phl-compute-06.internal (phl-compute-06.internal [10.202.2.46]) by mailfout.phl.internal (Postfix) with ESMTP id 58051EC0652 for ; Wed, 11 Nov 2026 11:08:10 -0500 (EST) Received: from phl-frontend-03 ([10.202.2.162]) by phl-compute-06.internal (MEProxy); Wed, 11 Nov 2026 11:08:10 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fastmail.org; h= cc:cc:content-transfer-encoding:content-type:date:date:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:subject:subject:to:to; s=fm3; t=1794413290; x= 1794499690; bh=xNI7FhhWXJTVEfgFdiCjAwu1qJ5S7uLHPAT406qre8I=; b=h 49wniB068XoKCYc16cwroR95107cIRIUqZArGJasPF8iCfif6ZrWhE6+n/8MQtNI WnEoF9SZE98wxsJORStlWBY+jXqsvavVfKm98js7heddFmR5coDb4km5lwAjdppQ Z+CiR6m3PUxB52b/itq0+H0QdG0n79KsL1E3R3Mi23aFK6uj6U46SZwVLU+g/idW NFkY2aPRX/DcdVOqiS45e9NWwV2jCDF9lGXDW0ip1bkqP1nPIkxM1p26GdeRgxlq YQCGppdAAaDd92Aw9aXYr0zCdmMVLuhqSPcPnyr+80CX9ncJXQd7b0QZ5T0KD8JT 8Ybgn/KZOsEk/8ijMJkuA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:subject:subject:to:to:x-me-proxy:x-me-sender :x-me-sender:x-sasl-enc; s=fm3; t=1794413290; x=1794499690; bh=x NI7FhhWXJTVEfgFdiCjAwu1qJ5S7uLHPAT406qre8I=; b=IFU7woW5wrHXHZG6t AFBd4EO8pbxiv8ZpiZJl3EvLfPIjZRZuLwX3DxVVBYW1m4i29mWHCAz+xh6PAqdc qclQlYnC3xOhKsuaUtF09J4AWZgUBi8OdaDuMpmLyuQp7y0zosPdSHAF2z5v1gVU ZH6iAMe6pZ9oBBVNTabAykD03GwWXjgaOaEOHHNVNPUjSTFZWDNBZkqUjCyfxg4A ziapT0EZPQBYjcsRDLf1YDUjJu/Qx/Ih0X/fIB8b4J3zqL9u9IF2lOUMiJ80VyPr 2BR+M2QT3NQKGvhdqm1lEftcjsqDt9m8W+0nEoeSGa7m61FfD1jBAMmVGJZyNdY9 J10+g== X-DKIM2-Info: draft=ietf-dkim-dkim2-spec-09; repo=github.com/dkim2wg/interop; date=2026-11-03; sw=lmtpprox; action=sign d=fastmail.org a=rsa-sha256; DKIM2-Signature: i=1; m=1; t=1794413290; d=fastmail.org; mf=PGljYkBmYXN0bWFpbC5vcmc+; rt=PGxpbnV4LWtlcm5lbEB2Z2VyLmtlcm5lbC5vcmc+; s=fm3:rsa-sha256:Zupp7CkAKJWdV7tytXdM50fPhq0tUlE+hKeWf8EHp40owXe fSLRtZuK2u2sxrZlhBWo8pqXwRED7SjR3QJnOY9gJSH9mw6xpCKmtI9J692jVIal FNDDajvT87OdH8knf+jGKWPlKfbLYr2lQCJue52UWz8aPRZCqHC9LRre7afOUAEL vuLF5bHmR0v3dbdpeEcDjskGOig4JLIe58dFtcajFn4iSusFBItkiSvgBMxqLXk5 3yaVf3U50PsgeVQ/4n8lix8TsCC9yqRDNZVPRLODUf8DcD9Oa35zZxUKql/0QjGa s4VTIE8MypSfvm+NNNUuPBfi6gysg+pPH09X6+A==; X-DKIM2-Info: draft=ietf-dkim-dkim2-spec-09; repo=github.com/dkim2wg/interop; date=2026-11-03; sw=lmtpprox; action=mi-m=1; hc=11; hn=cc,content-transfer-encoding,date,feedback-id,from, in-reply-to,message-id,mime-version,references,subject,to; Message-Instance: m=1; h=sha256:IrfuLGt7KRhZcItFVJOYu4jJrkvaWCkKSe7X6yBCEEI=:j3mfKCSAZysz8cOYO4xunMlz4f8Xoig17FxZxB7+pAQ=; X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTEGiWpjkAqvpdpTZAueIN2nKSWOBCp/471wSdPjoZ6M4A7svfpQVH1R8hL0xV027/ e/Kc7t5m5zPL0cbReHQKNc5TdJDTo0B9hXmMzycYcte96r8JDR2uPmZPqUWM0DzimKCgdm Js4TJUWLPj3WH9yiGOKX/Z1Ijz8WIQ05VA35XI6CHJrBzU7UWxlE6R9xvZ0B/cyNv7Xm3L 5rKv8i28Vg4bQXfxrtySwyKEQjLwngDFIhc2+Q1N+AdzaJ/KasUAdq5US6/JhmoAqVXSW0 54pZcTWvZ9LtMFIjdyMWDcT6HAVQSBA88K+xj9JEI1cA3aG9bWoe5ScMMuy4q18OWdN7tI bAd79twYMGOTX2E1qNkzINWfv0r6Z6XOhRmW7hTOQ/IhU+52ziBJE0ONQiT+L95WCFeEne 4VigZaFsXqwpQZyRqzuSpi7MGKUuE/+I59r7EfS+86c9r6+PxkYwXnnDAL1ehVDi3TZ/Df n4lUsk+bZtNrg89Ea42L75BsP8lzCwkKX/c+EalxIeCzxQiVmV7MSuFidWX0+iYcS9zt5Z GuWXtgR+wr8vk1vIxwHui/eqD8QuN+9kdkKhBUe2kfngaf7H2iw4KiCLKOFYNgumrFh3De TYu3EBqN5BEC6lVykz6+9v+wOVJ7jet88Dxl46gZFIuF4XcA4z3skmGCv6Ug X-ME-Proxy: Feedback-ID: ib53e4b78:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Wed, 11 Nov 2026 11:08:08 -0500 (EST) From: Ian Bridges To: jan.koester@tuxist.de Cc: linkinjeon@kernel.org, senozhatsky@chromium.org, tom@talpey.com, chenxiaosong@chenxiaosong.com, brauner@kernel.org, linux-cifs@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, Ian Bridges Subject: Re: [RFC PATCH 4/6] ksmbd: map user and group ids to Windows SIDs through user space Date: Wed, 11 Nov 2026 10:08:03 -0600 Message-ID: <20261111160803.4128207-1-icb@fastmail.org> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Hi Jan, On Tue, Nov 10, 2026 at 09:02:46AM +0000, Jan Koester wrote: > + * one) and ksmbd's. Built at login; a > + * mapping user space couldn't give then is missing for the session (its > + * ACL entries don't match: access is denied, not granted). [...] > + sids = kcalloc(max, sizeof(*sids), KSMBD_DEFAULT_GFP); > + if (!sids) > + return; > + if (!mapped_uid_sid(user->kuid, &sids[n])) > + n++; If user space cannot answer at login (-EAGAIN), ksmbd_user_set_token() seems to leave that domain SID out of the token. It builds no token at all when the allocation fails. The comment says access is then denied. That holds for an allow ACE on that SID, but wouldn't a deny ACE on it stop applying? Take a DACL with a deny of WRITE_DATA for a mapped group, followed by an allow of full access for Everyone. Would a member whose group SID is missing get write access through the Everyone entry for the whole session? Could -EAGAIN and allocation failures be returned from the token build so the login fails, while -ENOENT, for an account with no mapping, stays as it is? Thanks, Ian